The Hybrid Cloud API Gateway Architecture with Zero Trust for Digital Banking
Abstract
The rapid adoption of digital banking services has increased the reliance on Application Programming Interfaces (APIs) to support integration, service delivery, and collaboration with external partners. However, the growing exposure of APIs has also introduced significant security risks, while financial institutions must simultaneously address scalability demands and regulatory compliance requirements. This study aims to design a Hybrid Cloud API Gateway Architecture integrated with Zero Trust Security principles for digital banking systems. The research employs a qualitative approach using the Design Science Research (DSR) methodology, consisting of literature review, requirements analysis, architecture design, expert validation, and architecture evaluation. The proposed architecture integrates API Gateway capabilities, Hybrid Cloud Architecture, and Zero Trust mechanisms to provide secure, scalable, and resilient banking services. Critical workloads and sensitive data are maintained within private cloud environments, while scalable services are deployed in the public cloud to improve flexibility and resource utilization. Evaluation results indicate that the proposed architecture aligns with NIST SP 800-207 Zero Trust Architecture principles, addresses major risks identified in the OWASP API Security Top 10, and supports compliance with PCI DSS and ISO/IEC 27001 standards. The proposed framework provides a practical reference for developing secure, scalable, and compliant digital banking infrastructures.
Downloads
References
M. Hamed, M. Hefny, Y. Helmy, and M. Abdelsalam, “Open Banking API Framework to Improve the Online Transaction between Local Banks in Egypt Using Blockchain Technology,” vol. 14, no. 4, 2023, doi: 10.12720/jait.14.4.729-740.
Vedaswaroop Meduri, “Hybrid Cloud Architectures for Scalable and Cost-Effective AI in Banking,” Int. J. Sci. Res. Comput. Sci. Eng. Inf. Technol., vol. 10, no. 6, pp. 1840–1849, 2024, doi: 10.32628/cseit241061226.
G. B. Navaretti, G. Calzolari, J. M. Mansilla-fernández, and A. F. Pozzolo, “Open Banking ’ s Promise of a Financial Revolution : Are We Falling Short ? 1 Open Banking ’ s Promise of a Financial Revolution : Are,” pp. 1–21, 2022.
Z. Butcher and Z. Butcher, “NIST Special Publication 800 Guidelines for API Protection for Cloud-Native Systems Guidelines for API Protection for Cloud-Native Systems”.
R. S. Sitorus et al., “Capability-Based API Gateway Technology Selection Analysis for Banking Cybersecurity Solution Using AHP Method,” vol. 9, no. 1, pp. 338–347, 2025.
O. Access, A. Katari, A. Muthsyala, and H. Allam, “Hybrid Cloud Architectures for Financial Data Lakes: Design Patterns and Use Cases,” Int. Res. J. Mod. Eng. Technol. Sci., no. 01, pp. 1421–1430, 2024, doi: 10.56726/irjmets5966.
P. Ranjan and S. Dahiya, “International Journal of Communication Networks and Information Security Advanced Threat Detection in API Security: Leveraging Machine Learning Algorithms,” Int. J. Commun. Networks Inf. Secur., vol. 13, no. 1, 2021, [Online]. Available: https://ijcnis.org/
Muhammad Sohail, “Intelligent threat detection and prevention in REST APIs using machine learning,” Int. J. Sci. Res. Arch., vol. 15, no. 2, pp. 012–027, 2025, doi: 10.30574/ijsra.2025.15.2.1281.
B. J. Hutagaol, R. S. Sitorus, and N. Hutagaol, “Identifikasi Tingkat Kesadaran Pengguna Mobile Banking terhadap Ancaman Cybercrime,” J. Teknol. Sist. Inf. dan Apl., vol. 7, no. 3, pp. 1043–1054, 2024, doi: 10.32493/jtsi.v7i3.41639.
D. Jaiswal, “Zero-Trust Architecture for Telecom API Security: A Framework for the Communications Economy,” Eur. Mod. Stud. J., vol. 9, no. 4, pp. 11–21, 2025, doi: 10.59573/emsj.9(4).2025.2.
R. S. Sitorus and B. J. Hutagaol, “Designing a Zero Trust Architecture for Securing API Gateways in Digital Banking Systems,” vol. 7, no. 3, pp. 2589–2601, 2025, doi: 10.51519/journalisi.v7i3.1219.
Oluomachi Eunice Ejiofor, Oluwafemi Olusoga, and Ahmed Akinsola, “Zero trust architecture: A paradigm shift in network security,” Comput. Sci. IT Res. J., vol. 6, no. 3, pp. 104–124, 2025, doi: 10.51594/csitrj.v6i3.1871.
S. Purella, “Zero-Trust Architecture in Distributed Financial Ecosystems,” Int. J. Comput. Eng., vol. 7, no. 20, pp. 11–26, 2025, doi: 10.47941/ijce.3075.
Manvitha Potluri, “Secure DevSecOps for financial compliance: Building compliant cloud-native pipelines,” World J. Adv. Res. Rev., vol. 26, no. 2, pp. 324–333, 2025, doi: 10.30574/wjarr.2025.26.2.1618.
S. Dai, “Banking Business in Digital Transformation: The Role of Cloud Computing,” J. Prog. Eng. Phys. Sci., vol. 3, no. 4, pp. 76–83, 2024, doi: 10.56397/jpeps.2024.12.11.
Aditya Sharma, “Compliance and Regulatory Challenges in Cloud Adoption for Financial Services: A Comprehensive Analysis,” J. Comput. Sci. Technol. Stud., vol. 7, no. 5, pp. 505–515, 2025, doi: 10.32996/jcsts.2025.7.5.57.
A. Meshram, “Hybrid Cloud Strategy for Mission-Critical Financial Software Applications,” Ijarcce, vol. 14, no. 12, pp. 987–992, 2025, doi: 10.17148/ijarcce.2025.1412136.
R. T. Natarajan, “Journal of Artificial Intelligence , Machine Learning and Data Science AI & Machine Learning in Applications Security and Vulnerability,” pp. 1–4, 2024.
V. Punniyamoorthy et al., “Secure and Governed API Gateway Architectures for Multi-Cluster Cloud Environments,” Arxiv, 2025.
R. S. Sitorus, B. J. Hutagaol, R. Triana, and I. Technology, “Cloud Native Zero Trust API Gateway Architecture for Digital Banking Systems,” vol. 7, no. 1, pp. 255–268, 2026.
Vaibhav Haribhau Khedkar, “The Transformative Impact of Artificial Intelligence and Machine Learning on Marketing Operations,” Int. J. Sci. Res. Comput. Sci. Eng. Inf. Technol., vol. 10, no. 6, pp. 176–182, 2024, doi: 10.32628/cseit24106166.
Z. Samira et al., “API management and cloud integration model for SMEs,” 2024.
N. F. Syed and S. W. Shah, “Zero Trust Architecture ( ZTA ): A Comprehensive Survey,” IEEE Access, vol. 10, pp. 57143–57179, 2022, doi: 10.1109/ACCESS.2022.3174679.
T. A. K. Manne, “Implementing Zero Trust Architecture in Multi-Cloud Environments,” Int. J. Comput. Eng., vol. 7, no. 3, pp. 74–82, 2025, doi: 10.47941/ijce.2753.
S. Huy, S. Ang, M. Ho, and V. Balasubramaniam, “Securing API Ecosystems in Banking: A Critical Review of Cyber Risks, Control Frameworks, and Future Trends,” Jordanian J. Informatics Comput., vol. 2026, no. 1, pp. 25–37, 2026, doi: 10.63180/jjic.thestap.2026.1.3.
O. Bajaber, “Towards Zero Trust Network Security via Programmable Data Planes,” ACM SIGMETRICS Perform. Eval. Rev., vol. 53, no. 3, pp. 36–39, 2026, doi: 10.1145/3788882.3788898.
B. Nicoletti, “Cloud Computing in Financial Services,” Cloud Comput. Financ. Serv., no. 03, 2013, doi: 10.1057/9781137273642.
A. Alhakim and S. Sofia, “Kajian Normatif Penanganan Cyber Crime Di Sektor Perbankan Di Indonesia,” J. Komunitas Yust., vol. 4, no. 2, pp. 377–385, 2021, doi: 10.23887/jatayu.v4i2.38089.
N. Karri, “Demystifying APIsation of Fintech: Transforming Financial Infrastructure through Interface Integration,” Int. J. Comput. Eng., vol. 7, no. 6, pp. 1–13, 2025, doi: 10.47941/ijce.2918.
O. C. Edo, T. Tenebe, E. Etu, A. Ayuwu, J. Emakhu, and S. Adebiyi, “Zero Trust Architecture: Trend and Impacton Information Security,” Int. J. Emerg. Technol. Adv. Eng., vol. 12, no. 7, pp. 140–147, 2022, doi: 10.46338/ijetae0722_15.
J. U. Umavezi and B. Odukale, “API Development and Modelling: Streamlining Financial Technology Integration for Seamless Digital Transactions,” Int. J. Res. Publ. Rev., vol. 6, no. 1, pp. 1556–1573, 2025, doi: 10.55248/gengpi.6.0125.0328.
Zulfa Qur’anisa, Mira Herawati, Lisvi Lisvi, Melinda Helmalia Putri, and O. Feriyanto, “Peran Fintech Dalam Meningkatkan Akses Keuangan Di Era Digital,” GEMILANG J. Manaj. dan Akunt., vol. 4, no. 3, pp. 99–114, 2024, doi: 10.56910/gemilang.v4i3.1573.
C. Aliliele, I. S. Mbonu, and U. Iwuanyanwu, “A Review of API Governance and Risk Prioritization Frameworks in Modern Financial Institutions,” pp. 395–433, 2023.
A. Rajis, “A Conceptual Integration of Architecture, Project Management and Governance,” Int. J. Proj. Manag., vol. 8, no. 1, pp. 66–73, 2026, doi: 10.47672/ijpm.2926.
Copyright (c) 2026 B. Junedi Hutagaol, Riama Santy Sitorus, Nadya Allia Putri
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
